That's right: someone who knows their credentials will be the focus of deliberate attacks should never use truthful personal details in response to these "secur

That's right: someone who knows their credentials will be the focus of deliberate attacks should never use truthful personal details in response to these "security questions." Perhaps this is a "best practice" for anyone involved in such sensitive situations, even while the true best practice would be for sites to not allow password resets using such unreliable authenticators.